Medium severity5.5NVD Advisory· Published Nov 11, 2019· Updated Jun 17, 2026
CVE-2019-18849
CVE-2019-18849
Description
In tnef before 1.4.18, an attacker may be able to write to the victim's .ssh/authorized_keys file via an e-mail message with a crafted winmail.dat application/ms-tnef attachment, because of a heap-based buffer over-read involving strdup.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
7- Range: <1.4.18
- tnef/tnefdescription
cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
Patches
Vulnerability mechanics
References
7- github.com/verdammelt/tnef/compare/1.4.17...1.4.18nvdPatchThird Party Advisory
- github.com/verdammelt/tnef/pull/40nvdExploitPatchThird Party Advisory
- lists.debian.org/debian-lts-announce/2019/11/msg00035.htmlnvdMailing ListThird Party Advisory
- lists.debian.org/debian-lts-announce/2021/08/msg00025.htmlnvdMailing ListThird Party Advisory
- usn.ubuntu.com/4524-1/nvdThird Party Advisory
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RMKFSHPMOZL7MDWU5RYOTIBTRWSZ4Z6X/nvd
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W7CPKBW4QZ4VIY4UXIUVUSHRJ4R2FROE/nvd
News mentions
0No linked articles in our index yet.